coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T43: cert count unreadable; plan reissue for the safe date

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:34:44 +01:00
parent 5c2432698d
commit 81f8f03730
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -1597,7 +1597,7 @@ assignee: claude-code
needs_human: true
decision_id: "e4db6c9f-d464-4185-b5a1-ea71e21d1b42"
depends_on: [NK-WP-0049-T18]
blocking_reason: "Founder accepted the inherited-pipe custody design 2026-10-27 with four optimizations (random negative-test token; non-echoing unlogged decrypt wrapper; value-free /jwks trust probe before the ceremony; synthetic-secret rehearsal on a throwaway network). Open: NetKingdom names the exact backup field and decrypt command; railiance-platform shows jwks_ca_pem and oidc_discovery_ca_pem presence and runs the probe; subnet and container names to agree; longer unseal window acceptance is still the founder's decision at window signing; railiance-cluster count needs an admin-side cert check. Then build and review the phase B module; a new founder-signed window is needed.""
blocking_reason: "Founder accepted the inherited-pipe custody design 2026-10-27 with four optimizations (random negative-test token; non-echoing unlogged decrypt wrapper; value-free /jwks trust probe before the ceremony; synthetic-secret rehearsal on a throwaway network). Open: NetKingdom names the exact backup field and decrypt command; railiance-platform shows jwks_ca_pem and oidc_discovery_ca_pem presence and runs the probe; subnet and container names to agree; longer unseal window acceptance is still the founder's decision at window signing; cert reissue is planned for no earlier than 2026-10-30T16:23Z (the founder's shell as ops-mason-builder cannot list cert-manager objects cluster-wide or in sso, so the count stays unproven and is not needed after that date). Then build and review the phase B module; a new founder-signed window is needed.""
state_hub_task_id: "485468fd-d56e-54d1-9bc7-97220c0c4a38"
```
@ -1621,6 +1621,8 @@ secrets-engine (`65a3dbe`, reply 5aeaadc9): new reviewed runner taking the clien
2026-10-27 founder decision: accept the secrets-engine inherited-pipe custody design (`65a3dbe`) with optimizations 1, 3, 4 and 5: the wrong-secret negative test uses a generated random token, so only the one real secret passes the founder terminal; the decrypt step runs through a fixed non-echoing, unlogged wrapper that refuses to run under `script` or tmux logging; railiance-platform runs a value-free OpenBao-side `/jwks` trust probe on the phase B network before the ceremony; and the full path is rehearsed with a synthetic client on a throwaway network. Not adopted now: namespace/ptrace hardening (2) and an agent-free source (7). This accepts a design only and authorizes no run.
2026-10-27: the founder tried the admin-side cert check as `ops-mason-builder`; cluster-wide and `sso` listing of certificates, certificaterequests and orders are Forbidden. The reissue therefore waits for 2026-10-30T16:23Z, the guaranteed-safe date from railiance-cluster; no count is required then.
**Done when:** the decision is answered, the owners confirm their steps in their own
workplans, and the NK49 phase B module, verifier and tests are reviewed to T38 depth. This
task does not run phase B and does not replace T18's live consumer login or owner acceptance.